Skip to main content

This article applies to Cloud.

Other available versions:

Version 6 | Version 5icon.qnmark.png

Available in:

StandardPremiumEnterprise
Small Business
Code42 Support

Endpoint Monitoring settings reference

This article applies to Cloud.

Other available versions:

Version 6 | Version 5icon.qnmark.png

Available in:

StandardPremiumEnterprise
Small Business

Overview

This article contains a reference guide for settings used to enable endpoint monitoring for your entire Code42 environment. To access endpoint monitoring, from the Organization Details select Edit and choose the Endpoint Monitoring tab.

Endpoint Monitoring

Enable endpoint monitoring

Item Description
a Removable media

Enables or disables scanning of file metadata on all removable media, such as USB drives or SD cards.

b Cloud service

Enables or disables detection of syncing files using these cloud storage apps:

  • Box
  • Box Drive (Mac only)
  • Dropbox
  • Google Backup and Sync
  • iCloud
  • OneDrive
    OneDrive for Business is not supported.
c Application activity

Enables or disables detection of file uploads and downloads in web browsers and other applications (for example, uploading attachments to web-based email or downloading files via FTP).

d File restore

Enables or disables detection of file-restore activity, such as restores of files belonging to other users.

e Pattern matching

Enables or disables detection of dangerous, malicious, or sensitive file metadata and file contents based on specified patterns using the YARA rule framework. Pattern matching requires creating a YARA rule file and manually deploying it to each user device. Unlike the other types of endpoint monitoring, pattern matching only searches files included in the user's backup file selection.

Pattern matching can scan for MD5 hash and filename matches on any file, but does not extract file contents of binary or compressed files. Practically speaking, this means pattern matching only searches the contents of plain text files, unless you create a rule targeting a specific binary string.

f Forensic search

Enables or disables Forensic File Search. Forensic File Search provides detailed visibility for Code42 administrators about:

  • Files on user devices, including files not selected for backup
  • Files stored only in cloud services

This enables administrators to search file metadata to gain a clearer understanding of file activity throughout the organization.

Requires a Forensic File Search product plan.

Google Drive File Stream activity not detected by endpoint monitoring
Google's Drive File Stream retrieves files by mounting a temporary internal drive partition on the user's device and streaming files to the temporary drive. The Code42 app only monitors file movement to external drives, so it does not detect this activity.